IconCUSame page. New people.
CLEARLY EXPLAINED

Your data.
Your choice.

Information about the website, app and browser plugin.

Who is responsible?

DaBrain CLIMB TECH GmbH, Dreilindenstraße 38, 14109 Berlin, Germany. For questions about your data, access requests or deletion, contact kontakt@dabrain-matrix.info . Find further details in our Legal notice.

When you visit the website

These IconCU pages do not load advertising or external fonts. A necessary cookie remembers your privacy choice. The website statistics described below remain off until you consent. When you access a page, hosting provider IONOS receives technically necessary connection data, including your IP address, time, requested address and browser information. These are used to deliver the pages and keep the service secure.

Optional website statistics and cookies

Only with your consent (section 25(1) TDDDG and Article 6(1)(a) GDPR) do we count page views, download clicks and active reading time on the home, download and help pages, in intervals of up to one minute. The purpose is to improve this website. We store daily totals by page type and event for 90 days. There are no user identifiers, account links, demographics, full URLs or analyses of other websites you visit. Page views do not represent unique visitor counts.

The necessary cookie iconcu_consent_v1 stores only your choice (necessary or statistics) for six months, with no identifier. “Necessary only” prevents statistics collection. You can withdraw consent just as easily at any time under “Cookie settings”; collection then stops. Aggregated daily totals cannot be linked to a person and therefore cannot be removed individually. No optional marketing services are loaded.

During transmission, the hosting provider also necessarily processes IP addresses. Its operational logs are separate from our aggregated statistics. We therefore do not claim that the internet connection is completely anonymous.

Protection against automated abuse

We limit requests to sign-in, chat, uploads and public data interfaces. We use short-lived counters with server-protected identifiers derived from the connection address that change daily. These counter files contain no plain-text IP addresses, accounts, messages or visited websites. The identifiers are pseudonymous, not completely anonymous. Expired counters are removed on the next access to their storage area; file counts and sizes are limited. Necessary abuse prevention is separate from optional usage statistics and does not set analytics cookies. Existing sign-in and failed-attempt limits remain in place as well. An unobtrusive form field helps reject automated registrations.

Date of birth

The current registration form asks new accounts for their date of birth as private account information. Other people see it only if you explicitly share it with a chosen audience in your profile. It is not added to website statistics. It can be corrected in your account and is deleted with the account. A self-declared date does not reliably verify age. Final age and youth-protection rules will be set separately before the relevant launch.

When you use the Web App

The Web App uses your existing IconCU account and the same server data as the desktop app. Your login is managed through a necessary Secure/HttpOnly cookie with SameSite=Strict, for at most eight hours. Your account password or session token is not stored in Local Storage. The Web App stores guest and account settings, layouts and manually added websites separately within your local browser profile. It uses the IconCU website as a pinned starting point. You choose your own visibility and chat identity. Messages, posts, uploaded media and public presence follow the same rules as in the app.

Browser notifications and microphone recordings require separate browser permission. Without a browser plugin, the Web App cannot read other browser tabs. With the extension you have authorised, it processes the URLs, titles and visibility of your selected tabs to match chats; excluded and private tabs are not transmitted.

Page notifications in the plugin

Live page notifications and the Web connection are enabled on new installations and can be turned off at any time. Previously saved choices to disable them are retained. Processing, visibility and the short lifespan of presence signals are described below under “Live page notifications and browser connection”.

When you connect a browser

When transmission is enabled, the extension reads the URLs and titles of normal open web tabs and passes them to the app on your computer. It does not read private windows, page contents, form input or passwords. The on/off switch stops queries for that browser. The setting and pairing code are stored in the browser profile.

The eye toggles the visibility of an individual tab. Hidden tabs remain visible in the app on your computer for management; their URLs and titles are still passed locally for that purpose. They no longer join the associated chat. Another visible tab of the same website can keep the shared chat active. New tabs are visible again after a full browser restart. Your browser-wide on/off choice remains saved across reconnections and browser restarts.

The app calculates room identifiers from public web addresses. From version 0.58.0, it also transmits the checked public URL context for server-side security checks; the technical title contains only the hostname. Personal addresses are discarded before this transmission. For website chats, query parameters and fragments are removed from the room address. A public Second Layer may instead store its checked full address, including public query parameters and fragments. Room identifiers are pseudonymous and do not guarantee anonymity.

On Windows, the app associates the local connection with the browser process to distinguish browsers such as Chrome and Brave. Only the connection port and process name are examined, not browser profiles or saved credentials.

For automatic browser pairing, the Windows app registers a local native messaging helper. Only explicitly permitted IconCU extensions can request the local pairing code through it. Account passwords are not read. If automatic pairing is unavailable, you can enter the code in the extension yourself.

Protection of personal web addresses

App 0.58.0 and extension 0.38.4 use the same fixed rules to check known sensitive hosts, private URL paths, credential parameters and recognisable personal identifiers. The new extension removes recognised private addresses and their original titles before transmission. The new Windows app also checks data from older extensions; it cannot retroactively prevent their original local transmission. The server checks supplied URL contexts as well and does not newly accept unknown opaque room identifiers without an allowed public context.

As an inactive hint, a public homepage with a neutral title may be shown instead of a personal address. The protected row remains disabled and creates no public room membership or presence. Original private addresses, titles, query data and fragment data are not stored for this purpose. This rule does not delete existing messages.

This check does not read cookies, login sessions, forms, third-party page contents or device fingerprints. It cannot recognise arbitrary login states. Unknown private URL structures may go unrecognised; this is not a general guarantee that every confidential page will be detected automatically. If in doubt, do not share sensitive pages.

When you chat

The server processes room membership, display names, messages and technical session data so participants can see one another and receive messages. Other people in the same chat see your name and messages. Each public website chat and the community chat stores at most 300 messages on the server. New messages replace the oldest messages in the same room. Leaving, pausing or the passage of time does not delete this history. These chats have no full-text search. History is stored separately from account data, outside the public web directory. When an account is deleted, its server-side chat messages are also queued for removal and deleted on subsequent account accesses; copies already received on other devices may remain. Turning a browser off does not delete messages already sent.

The connection to our server uses HTTPS. Messages are not end-to-end encrypted and can be processed by the operator. Do not post confidential information in public chats.

When you use an account

We store your email address, username, creation time and a protected password verifier, never your password in plain text. Logins expire. Your email address is not sent to other chat participants. You may optionally provide your first name, surname and postal address. Username, first name and surname are fixed in the app after registration; your address remains editable. Contact us if fixed details need correction. Your postal address is accessible only to you and the operator. You may separately set profile visibility for individual linked details such as your name, location and country. Under “Your account”, you can change your password or delete your account using your current password. This removes your personal details, own posts, comments, personal messages and media. Other group members retain their messages; copies already received and limited website-chat histories may remain on other devices. Private backups are kept separately and may contain data until replaced. Alternatively, you can sign in with a one-time email code. It is sent through our hosting provider IONOS, lasts ten minutes and is stored only as a protected verifier in account storage. For an unconfirmed registration, details and the password verifier are stored temporarily; expired requests are removed when subsequent code requests are made. We limit requests and failed attempts to prevent abuse. Browser autofill data is transmitted only when you submit the form. “Forgot password?” lets you set a new password after verifying a one-time email code. Existing sessions then end. Changing your login email requires your current password and confirmation codes sent to both old and new email addresses. Codes last ten minutes, are stored only as protected verifiers and are blocked after five incorrect attempts. Other sessions are signed out after a successful change.

When you open a Second Layer

Opening an empty Second Layer temporarily prepares its public web address and name. It becomes permanent after the first saved interaction: a message in its website chat or whole-site chat also suffices. URL parameters and fragments are retained for matching; do not open confidential or personal-only addresses. Public posts, reviews, comments and media can be read without signing in. Publishing and commenting in Second Layer, friend lists and account-based chats require an account. Private guest messages are also possible without an account and are described separately below.

Posts, reviews, comments, images, videos, reactions, bookmarks, layouts and settings are stored persistently, without an automatic deletion deadline. You can edit and delete your own content. Media is stored on our infrastructure; the original website operator receives no special rights. Reports go to IconCU.

Public profiles, friends and timeline

Each account has a profile under its username. Name, date of birth, location, country and email use the same account record as registration. Profile visibility, further optional information and media are stored in addition; saving does not create a second copy of linked core details. For additional text fields and your timeline posts, choose Public, Friends or Only me and change that choice later. Your display name is always public. Language is initially public for new profiles and can be changed or restricted. German is preselected for addresses in Germany. Location and country may be prefilled from your private address but remain private unless you share them. Your contact email matches your login address and is private by default; you may explicitly share it. Profile and cover pictures, username and joining month are public; these profile details are not shown to blocked accounts. Public content can generally be read without signing in. The app optimises profile images you explicitly select before upload and removes embedded image metadata.

Friend requests and accepted friendships, contact settings, blocks, timeline posts, images, comments, star ratings and reports are stored to provide these features. The friends list is initially visible to friends. Friendships can be ended and requests withdrawn or declined. Blocking ends a friendship and prevents new direct contact. Unblocking does not restore the friendship.

You can delete your own posts and comments. Account deletion removes the profile, relationships, own timeline, associated comments by others and own media. We cannot recall public content already copied onto other people’s devices. Unpublished uploads are accessible only to the uploading account and are removed no later than when that account is deleted. Profiles and timelines have no automatic deletion deadline. Reports are for operator review and are not public.

Signing in on the website

After sign-in, the account page uses a necessary session cookie (__Host-iconcu-session). It is transmitted only over HTTPS, cannot be read by page scripts and is restricted to this website. It keeps you signed in for at most eight hours and is removed when you sign out or delete your account. It serves only the requested account feature, not advertising or analytics. Passwords and session keys are not placed in links or local browser storage.

If you start sign-in from the app, we store a random connection identifier and verifier for at most five minutes. Only your confirmation on the account page connects your account to the requesting app. The app must also present a one-time proof held only there. Used requests are removed immediately; expired ones on the next request. These account features use the same private account storage as the app.

Personal messages and groups

Only active members can retrieve their conversations and media. Messages and attachments are stored persistently. Leaving a group does not delete history for its remaining members. Transmission uses HTTPS; there is no end-to-end encryption. The operator can technically process this data.

Presence and notifications

Personal presence is enabled by default on first use. Your later choice is retained. Find website and Second Layer presence switches under “Visibility” in the app; the presence list updates automatically. Website chat and Second Layer can be configured independently: with an account, with a guest name for website chat, or without chat; Second Layer also offers anonymous reading. With visible presence, the server processes identifiers for open websites and the current Second Layer along with your username. The display distinguishes the two locations and expires after 60 seconds without further activity. Replies, mentions, messages and invitations may trigger account notices and local Windows notifications. You can turn these off by section, mute conversations and block other users. No content is sent to an AI service.

Anonymous reading mode and community overview

Anonymous reading mode pauses public writing and removes your shared presence. Your account stays signed in for personal conversations. Earlier content retains its username. The server still processes your session and technical connection data; this does not anonymise you to the operator. Public author profiles show contribution counts and received quality ratings. Individual raters are not listed there. Community rankings count published content and only recently shared presence on known Second Layer websites; they show neither private conversations nor browsing histories.

Star ratings are stored per account, target and criterion. Public displays show averages and counts, not a list of raters. You can change or withdraw your rating. Optionally publish text with a website review. It appears under your username and can be commented on by other signed-in people. Editing retains comments; withdrawing makes the written review publicly inaccessible. Stars without text still do not show a list of individual raters. Ratings are subjective experiences, not fact-checks. Online statistics count active accounts across devices and guest connections; they do not name anonymous readers. Active rooms are listed only for already published websites and counted using recent messages.

Documents and voice messages

Sent documents and audio attachments are accessible only to active conversation members, like personal messages. Microphone recording starts only after your click, lasts at most two minutes and can be previewed or discarded before upload. During transfer, a temporary file is created in the local app profile and removed after upload. Added but unsent attachments initially remain accessible only to the uploading account.

On your computer

The app stores settings, excluded domains and browser pairing. Views, window positions, manually added websites, selected Second Layers and hidden pages are restored locally per account or guest profile. Locally stored hashes are used to compare hidden browser pages. The browser plugin also retains an off setting. Credentials are protected using the operating system’s secure storage. Updates preserve these settings. The running app’s message history is held in memory.

Your choices

Hide individual tabs with the eye, turn browsers off, exclude domains in app settings, pause all chats or sign out. Contact us using the details above for questions about stored data or deletion.

Last updated: 20 October 2026

Public community statistics

Live statistics show aggregated current account and connection counts alongside publicly available posts, media and reviews. Private messages, group content and non-public timeline posts are neither displayed nor counted for this purpose. The statistics create no additional visitor profiles and use no analytics cookies. Connections are no longer considered online after 60 seconds without a heartbeat.

Favourites, current view and guest contacts

Favourites are saved to your account so you can find the same Second Layers and website chats across your devices. Your confirmed friends may see your current view as a website, Second Layer or chat. This setting is initially on and can be disabled under Visibility. Hidden and anonymous views remain excluded. Presence replaces the previous status and expires after 60 seconds; it does not create a browsing history.

For private guest messages and blocks that survive name changes, the app generates a random guest identifier. Its secret is stored in the browser profile or encrypted in the Windows user profile. The server uses an identifier derived from it. Deleting local data or using a different browser profile creates new guest access. This technology therefore cannot recognise a person across every device. Guest conversations retain at most 300 messages each; new messages replace older ones. Guest names, contact associations, read positions and blocks are stored to provide this feature. There is no end-to-end encryption.

Optional release news by email

You receive designed release newsletters only after explicitly opting in and verifying your login email address. We store the time of consent, an email-address verifier and delivery status per version to honour unsubscribes and prevent duplicate messages. Consent is the legal basis. Withdraw it at any time in your profile or through the link in every message. Changing your email address requires a new opt-in for that address. There is no open or click tracking. Embedded images load from our own website, generating ordinary technical connection data. Replies go to kontakt@dabrain.biz.

Local response-time history

The statistics page shows only technical availability and response times of our own web and chat servers from existing server monitoring. Public history covers six hours and contains only measurement times and milliseconds; internal operational logs and user data are not published. The separate browser connection time is measured locally when statistics are fetched. No extra cookies are set and no personal measurement histories are sent for usage analysis. Missing or stale measurements are marked.

Optional feedback

“Send feedback” submits a category, your comment, the app version and optionally a screenshot and contact email to the IconCU team. The app does not take screenshots without your selection. Selected images are resaved as PNG and limited to 1,920 pixels and 2 MB before transfer. Remove confidential content before sending. Reports receive a random reference number and are stored outside the public web directory. Only staff handling them have access; the email to the team contains only the reference number and category. Closed reports are deleted after 90 days; open reports remain until handled. You can request deletion through the contact details in the legal notice, quoting your reference number. Short-lived protected request counters limit abuse; browser tabs and chat histories are not automatically attached.

FRIEND INVITATIONS

Email invitations

On your explicit instruction to send, we process selected recipient addresses, your public username and your optional message for each invitation. Invite only people who have explicitly agreed to receive that email beforehand. An invitation is not a newsletter subscription. Recipients do not see anyone else’s address.

Contact files are processed locally; only the selected addresses are sent to our server when you send. Pending delivery data stays in a private queue for at most 24 hours and is removed when delivery is attempted. Technical delivery records and pseudonymous recipient identifiers are removed after 30 days. Safeguards prevent repeat invitations within seven days. An opt-out link in each invitation prevents further invitations; the necessary non-public, keyed recipient identifier is retained to honour that choice. Your optional message is sent as text and is not published publicly.

Processing your delivery request provides the requested feature; advertising to recipients requires their prior consent. Abuse prevention and respecting opt-out requests serve our legitimate interests. Use the contact details above with questions or to exercise your privacy rights.

Your installed-app choice

If you indicate on the account page whether IconCU is installed on this device, we remember only that choice in this browser’s local storage. It is not sent to our server and does not detect installed programs. Use “Change answer” to revise it at any time. Clearing browser data also removes this choice.

Participant lists in website chats

The participant list shows presence currently shared with that chat, not a full browsing history. Multiple connections from the same account are combined. Profile information respects the member’s visibility choices and existing blocks. Guests appear with their chat names and no linked member profile.

Public activity and moderation

The app shows the latest public Second Layer posts, photos, videos and reviews. For star-only ratings, this overview shows activity on the website, not the person who voted. Profile pictures are linked to the current profile and therefore update alongside older posts and messages. Blocks are respected.

Authorised administrators can remove public content and individual ratings. The administration interface does not provide access to private conversations or private profile posts. To trace deletions, we internally record the administrator account, content type, content identifier and time, without copying the deleted text. This log is limited to 20,000 entries. The data is not public.

Visible online presence

For visibly present registered accounts, IconCU shows a current heartbeat from a website, Second Layer or chat. The online friends list contains only confirmed friends. When “Share activity with friends” is enabled, confirmed friends see the shared website and active section. You can turn this off. Mutual blocks and your visibility settings are respected. A heartbeat expires after at most 60 seconds; no permanent activity history is created.

Explainer videos load directly from our website. They start only when you choose to play them and do not need an external video provider.

Technical app connection status

When connecting, the desktop app sends its version, operating system (Windows, macOS or Linux) and a random identifier for that app start. The identifier changes at restart and is not a device fingerprint. For this connection overview, administrators see only the count of fresh connections by version, not names, visited pages or device identifiers. Connections become inactive after 60 seconds without contact and are cleaned up on the next server request. This supports troubleshooting and secure operation. No permanent installation history is created.

Live page notifications and browser connection

New browser connections have page notifications and the official Web App connection enabled. Previously saved choices to turn them off are retained. You can disable both in the plugin. Firefox requests the required data categories during installation.

When page hints are enabled, the extension sends calculated identifiers of visible public tabs and a random, daily changing browser identifier to dabrain.biz about every 30 seconds and after visibility changes. Extension 0.38.4 also sends the checked public URL for server-side association and security checks. Incognito windows, hidden tabs and personal areas recognised by the URL rules are excluded. No page contents or saved browsing-history databases are read. The identifiers are pseudonymous, not anonymous. The service technically receives the connection IP address; the extension does not use it to determine location.

The presence list is replaced and counts only signals from the last 90 seconds. Turning it off attempts immediate removal; after connection loss, it expires within 90 seconds. Expired entries are cleaned up on the next query. The private, size-limited presence table is separate from the account database. It creates no browsing history. Pause and visibility settings of connected current apps are respected; the stricter choice applies. Only totals are public, not browser identifiers or tab lists. Browser counts can include several devices used by one person and do not represent unique people. The Web App and local app still receive URLs and titles while their respective connections are enabled.

Moderation and appeals

Guest access receives a random local identifier. Changing a guest name does not change it. To enforce an access restriction, identifiers of accounts signed in through the same app may be associated for up to 30 days. We briefly store a non-public hash of the network address generated with a server key (24 hours). An additional network block is optional, expires after 24 hours and may affect several people sharing a network. This does not reliably prove a person’s identity.

Restrictions include reasons and can be lifted. Under Account → Restriction & appeal, affected people can submit an appeal and read the reply even while access is restricted. Resolved appeals are cleaned up after 180 days on the next submission. Administrative changes are logged.

Optional app usage statistics

Additional app statistics are initially off. Only after your consent do we send brief reports about actively used areas: Second Layer, website chat, personal chats and groups, profile or navigation. The statistics record contains only month, platform or optional demographic category, report count and accumulated seconds. It contains no account identifier, IP address, web address or message content. You can optionally provide broad age, gender and usage-duration categories; registration data is not copied into these statistics.

The server necessarily sees the connection’s IP address. Necessary security logs and abuse prevention are handled separately. Usage statistics store no identifier for recognising individual people. The numbers therefore represent reports, not unique users. Small demographic groups are suppressed in the analysis. Monthly totals are retained for about twelve months at most. Withdraw consent for future collection at any time under “Statistics & privacy”. Already aggregated data cannot be linked to a person.

Local drafts

To recover after a restart, we save text drafts and references to already uploaded attachments on your device for up to 30 days, separated by local account or guest profile. The Windows app uses Windows encryption; the Web App uses local browser storage. These drafts are not sent to our server as drafts. Delete them under “Drafts”. Original files that have not uploaded are outside this backup.

Shared media from other providers

For supported video and audio links, the external player loads only after your click. The provider then receives the data needed for the connection, particularly your IP address. Its privacy rules apply as well. Access permissions for a shared public original are checked again when it is retrieved.

Profile contacts, experience points and paired browsers

Each additional email address and profile link has its own visibility setting. Experience points belong to your account. For your points history and duplicate checks, we store the activity type, time, points and hashes of the source and content, without storing another copy of the message text. Deleting your account also deletes this points log.

The paired PC app can forward shared tabs from other connected browsers to the official web app. Automatic sign-in uses a one-time grant, valid for 45 seconds and bound to the request. Your password and the PC app’s sign-in token are not transferred to browser extensions. Another signed-in account is never replaced; explicitly signing out disables automatic sign-in in that browser.

Language and level notifications

On a first visit to the neutral home address, a local IP-to-country table selects German for Germany and English elsewhere. Your IP is not sent to DB-IP for this purpose and is not stored in an additional visitor history. VPNs and outdated mappings may affect the result. Your manual language choice is stored locally and takes precedence; direct language links remain available.

Level achievements are stored with your account. Congratulations emails go only to your verified sign-in address and can be disabled in your profile or through the link in the email. Profile showcase recommendations start private; you choose the audience for each. Favourites collections remain private.

Optional Google address suggestions

Address suggestions start switched off. If this feature is configured and you explicitly enable it in the form, your search text and a temporary session identifier are sent through our server to Google Places. You can always enter your address manually without Google. Only the address you select and save becomes part of your account.

Guest access in your browser

IconCU stores a protected cookie in your browser for guest access. Multiple tabs in the same browser profile use the same guest identity. Other browser profiles and private windows are separate. Clearing your browser data can create a new guest identity.

The cookie is valid for up to one year and is renewed when used. Your guest identifier is not calculated from your IP address or a device fingerprint.

After four days without activity, the guest identity is removed from the active guest list. Its messages remain and are marked as messages from an inactive guest. The necessary author reference and existing moderation rules are preserved. Returning with the same cookie reactivates the same guest identity.

Reset your password

Use “Forgot password?” to request a one-time email code. It lasts ten minutes and allows at most five incorrect attempts. After successful verification and choosing a new password, previous logins and outstanding codes become invalid. We send a confirmation without including the password. The code-request response does not reveal whether an account exists.

Version and operational information

Connected apps report their version and platform. Supported browser plugins also report their version and browser type through the connected app. Short-lived connection identifiers help avoid counting the same connected browser twice. Administration shows aggregated version counts for connections seen in the last 60 seconds; no additional visited websites or message contents are transmitted for this purpose. Apps running offline cannot be counted.

Optional AI product help

When you send a question to AI help, your question and selected relevant public help texts are sent through our server to OpenAI. Follow-up questions may include the short previous conversation in that help window. Please do not enter passwords or private content. Account details, private conversations, browser tab lists and other account activity are not automatically included as context.

IconCU does not permanently store the help dialogue as a conversation log. Closing the help window discards its local history. Browser help may set a protected cookie valid for 30 days to check requests and limit usage. Bounded usage counters and protective hashes are kept without the question text. Processing by OpenAI is also subject to the terms of the API service used.

AI help has no tools to change accounts, content or system settings. You can use the website and apps without it; public guides remain directly accessible. Your device remembers whether introductions were completed or dismissed so they do not keep appearing.

Optionally saved sign-in details

Optional password storage in the PC app happens only after a successful sign-in and your explicit choice, encrypted through the operating system and bound to the verified server. You can remove the saved entry on that computer. Signing out alone does not delete storage you explicitly chose. A password sign-in without the save option, a confirmed password or email change, or account deletion removes it. On the website and web app, your browser’s password manager controls saving. Personal 2FA for administration remains required.

Optional voice input for product help

Recording starts only after your microphone click. After stopping, up to 30 seconds of audio are sent through our server to OpenAI for transcription. IconCU stores neither the recording nor the recognised text as a log. The text stays editable before you send it separately as a question. Reserved audio seconds and a protected browser identifier are counted for usage limits. OpenAI processing follows its applicable terms; do not dictate passwords or confidential content.